Win32.HLLW.Autoruner1.10686

Added to the Dr.Web virus database: 2012-01-06

Virus description added: 2012-01-06

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'cftmon' = '%APPDATA%\zgwc.exe'

Malicious functions:

Creates and executes the following:

Modifies settings of Windows Internet Explorer:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1400' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnOnZoneCrossing' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnonBadCertRecving' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnOnPostRedirect' = '00000000'

Modifies file system :

Creates the following files:

Sets the 'hidden' attribute to the following files:

Deletes the following files:

Deletes itself.

Network activity:

Connects to:

TCP:

HTTP GET requests:

www.wi###date1.info/machineid.php?ch#################################################################################################

HTTP POST requests:

UDP:

Miscellaneous:

Searches for the following windows: